Which SIEM platforms have a THREAT-Recon-DistributedVulnScanBurst detection rule?

df00tech provides THREAT-Recon-DistributedVulnScanBurst (Distributed Vulnerability Scanning Burst Against Web Infrastructure) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the THREAT-Recon-DistributedVulnScanBurst detection?

The THREAT-Recon-DistributedVulnScanBurst detection is rated high severity with medium confidence.

What are common false positives for THREAT-Recon-DistributedVulnScanBurst?

Common false positives for THREAT-Recon-DistributedVulnScanBurst include: Authorized internal or contracted vulnerability management scans (Qualys, Nessus, Tenable, Rapid7) running against production on an approved scanning schedule; Bug bounty researchers or penetration testers operating within an approved rules-of-engagement window; Uptime/synthetic monitoring services (Pingdom, UptimeRobot, StatusCake) or health-check bots hitting many paths from a small set of monitoring IPs.

THREAT-Recon-DistributedVulnScanBurst

Distributed Vulnerability Scanning Burst Against Web Infrastructure

Q: What data sources are required to detect Distributed Vulnerability Scanning Burst Against Web Infrastructure (THREAT-Recon-DistributedVulnScanBurst)?

Detecting Distributed Vulnerability Scanning Burst Against Web Infrastructure requires the following data sources: WAF logs forwarded as CEF (F5 ASM, Imperva, Fortinet FortiWeb, Palo Alto), Azure Application Gateway / Front Door WAF logs, Reverse proxy / perimeter firewall access logs.

Reconnaissance Last updated: July 20, 2026

Adversaries and access brokers run automated vulnerability scanners against externally-facing web infrastructure to fingerprint exposed technology and locate exploitable misconfigurations before initial access. Two patterns dominate: a concentrated burst, where a single source IP fires a wide diversity of scanner-signature requests (config file probes, admin panel paths, framework actuator endpoints, path traversal, webshell probes) at a target within minutes; and a low-and-slow variant, where a small rotating pool of source IPs within the same /24 subnet or hosting-provider ASN spreads the same signature diversity across a much longer window to stay under per-IP rate-limit thresholds. Both patterns are typically observed in WAF, reverse-proxy, or perimeter firewall logs rather than endpoint telemetry, since the target is the externally-facing HTTP surface itself. Detection prioritises the diversity of distinct scanner-signature categories touched per source (or per rotating subnet) over raw request volume, since volume alone is indistinguishable from normal crawler/bot traffic while signature diversity is not.

What is THREAT-Recon-DistributedVulnScanBurst Distributed Vulnerability Scanning Burst Against Web Infrastructure?

Distributed Vulnerability Scanning Burst Against Web Infrastructure (THREAT-Recon-DistributedVulnScanBurst) maps to the Reconnaissance tactic — the adversary is trying to gather information they can use to plan future operations in MITRE ATT&CK.

This page provides production-ready detection logic for Distributed Vulnerability Scanning Burst Against Web Infrastructure, covering the data sources and telemetry it touches: WAF logs forwarded as CEF (F5 ASM, Imperva, Fortinet FortiWeb, Palo Alto), Azure Application Gateway / Front Door WAF logs, Reverse proxy / perimeter firewall access logs. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Reconnaissance

Microsoft Sentinel / Defender

kusto

let ScannerPathSignatures = dynamic([".env", ".git/config", ".git/HEAD", "wp-login.php", "wp-admin/setup-config.php", "xmlrpc.php", "phpmyadmin", "actuator/env", "actuator/health", "console/", "manager/html", "solr/admin", "cgi-bin/", "../../../../etc/passwd", "shell.php", "config.php.bak", "vendor/phpunit", "telescope/requests", "debug/default/view", "server-status", "eval-stdin.php"]);
let ScannerUserAgents = dynamic(["sqlmap", "Nikto", "Nessus", "Acunetix", "masscan", "zgrab", "Nuclei", "dirbuster", "gobuster", "wpscan", "OpenVAS", "Qualys"]);
// Alert 1: Concentrated burst - many distinct scanner signatures from one source IP in a short window
let Burst = CommonSecurityLog
| where TimeGenerated > ago(1h)
| where isnotempty(RequestURL)
| where RequestURL has_any (ScannerPathSignatures) or (isnotempty(RequestClientApplication) and RequestClientApplication has_any (ScannerUserAgents))
| extend MatchedSignature = case(
    RequestURL has ".env", ".env",
    RequestURL has ".git", ".git",
    RequestURL has "wp-login" or RequestURL has "wp-admin", "wordpress_admin",
    RequestURL has "xmlrpc.php", "xmlrpc",
    RequestURL has "actuator", "spring_actuator",
    RequestURL has "phpmyadmin", "phpmyadmin",
    RequestURL has "solr/admin", "solr_admin",
    RequestURL has "manager/html", "tomcat_manager",
    RequestURL has "../../" or RequestURL has "..%2f", "path_traversal",
    RequestURL has "shell.php" or RequestURL has "eval-stdin", "webshell_probe",
    isnotempty(RequestClientApplication) and RequestClientApplication has_any (ScannerUserAgents), "scanner_useragent",
    "other_scanner_signature"
  )
| summarize DistinctSignatures = dcount(MatchedSignature), DistinctPaths = dcount(RequestURL), TotalRequests = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Signatures = make_set(MatchedSignature), TargetHosts = make_set(DestinationHostName) by SourceIP
| where DistinctSignatures >= 6 and DistinctPaths >= 10
| extend BurstDurationMinutes = datetime_diff('minute', LastSeen, FirstSeen)
| extend DetectionType = "ConcentratedBurst", RiskScore = case(DistinctSignatures >= 15, 95, DistinctSignatures >= 10, 88, 78);
// Alert 2: Low-and-slow - rotating source IPs within the same /24 spreading scanner signatures across a long window
let LowAndSlow = CommonSecurityLog
| where TimeGenerated > ago(24h)
| where isnotempty(RequestURL)
| where RequestURL has_any (ScannerPathSignatures) or (isnotempty(RequestClientApplication) and RequestClientApplication has_any (ScannerUserAgents))
| extend Subnet24 = strcat(tostring(split(SourceIP, ".")[0]), ".", tostring(split(SourceIP, ".")[1]), ".", tostring(split(SourceIP, ".")[2]), ".0/24")
| extend MatchedSignature = case(
    RequestURL has ".env", ".env",
    RequestURL has ".git", ".git",
    RequestURL has "wp-login" or RequestURL has "wp-admin", "wordpress_admin",
    RequestURL has "xmlrpc.php", "xmlrpc",
    RequestURL has "actuator", "spring_actuator",
    RequestURL has "phpmyadmin", "phpmyadmin",
    RequestURL has "solr/admin", "solr_admin",
    RequestURL has "manager/html", "tomcat_manager",
    RequestURL has "../../" or RequestURL has "..%2f", "path_traversal",
    RequestURL has "shell.php" or RequestURL has "eval-stdin", "webshell_probe",
    isnotempty(RequestClientApplication) and RequestClientApplication has_any (ScannerUserAgents), "scanner_useragent",
    "other_scanner_signature"
  )
| summarize DistinctSignatures = dcount(MatchedSignature), DistinctSourceIPs = dcount(SourceIP), DistinctPaths = dcount(RequestURL), TotalRequests = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), SourceIPs = make_set(SourceIP), Signatures = make_set(MatchedSignature) by Subnet24
| where DistinctSourceIPs >= 3 and DistinctSourceIPs <= 25 and DistinctSignatures >= 8
| extend DetectionType = "LowAndSlowSubnetRotation", RiskScore = case(DistinctSignatures >= 15, 92, DistinctSignatures >= 10, 82, 72);
union Burst, LowAndSlow
| sort by RiskScore desc, DistinctSignatures desc

Two-alert KQL detection over CommonSecurityLog (WAF/reverse-proxy/firewall CEF telemetry): (1) ConcentratedBurst flags a single source IP touching >=6 distinct scanner-signature categories across >=10 distinct paths within a 1-hour window; (2) LowAndSlowSubnetRotation flags 3-25 distinct source IPs within the same /24 subnet collectively touching >=8 distinct scanner-signature categories across a 24-hour window, indicating rotation to evade per-IP rate limiting. RiskScore scales with signature diversity.

high severity medium confidence

Data Sources

WAF logs forwarded as CEF (F5 ASM, Imperva, Fortinet FortiWeb, Palo Alto) Azure Application Gateway / Front Door WAF logs Reverse proxy / perimeter firewall access logs

Required Tables

CommonSecurityLog

False Positives

Authorized internal or contracted vulnerability management scans (Qualys, Nessus, Tenable, Rapid7) running against production on an approved scanning schedule
Bug bounty researchers or penetration testers operating within an approved rules-of-engagement window
Uptime/synthetic monitoring services (Pingdom, UptimeRobot, StatusCake) or health-check bots hitting many paths from a small set of monitoring IPs
SEO crawlers, CDN health probes, or archival bots (Googlebot, Bingbot, Wayback Machine) traversing many URL paths that incidentally overlap scanner signature patterns
Load testing tools or CI/CD smoke tests hitting numerous endpoints rapidly from a shared build-agent IP address

Splunk

spl

index=waf OR index=firewall OR sourcetype=cisco:asa OR sourcetype=f5:bigip:asm OR sourcetype=fortinet:fortiweb
(uri_path="*.env*" OR uri_path="*.git*" OR uri_path="*wp-login*" OR uri_path="*wp-admin*" OR uri_path="*xmlrpc.php*" OR uri_path="*actuator*" OR uri_path="*phpmyadmin*" OR uri_path="*solr/admin*" OR uri_path="*manager/html*" OR uri_path="*../../*" OR uri_path="*shell.php*" OR uri_path="*eval-stdin*" OR http_user_agent="*sqlmap*" OR http_user_agent="*Nikto*" OR http_user_agent="*Nessus*" OR http_user_agent="*Acunetix*" OR http_user_agent="*masscan*" OR http_user_agent="*zgrab*" OR http_user_agent="*Nuclei*" OR http_user_agent="*dirbuster*" OR http_user_agent="*gobuster*" OR http_user_agent="*wpscan*" OR http_user_agent="*OpenVAS*" OR http_user_agent="*Qualys*")
| eval MatchedSignature=case(like(uri_path,"%.env%"),".env", like(uri_path,"%.git%"),".git", like(uri_path,"%wp-login%") OR like(uri_path,"%wp-admin%"),"wordpress_admin", like(uri_path,"%xmlrpc.php%"),"xmlrpc", like(uri_path,"%actuator%"),"spring_actuator", like(uri_path,"%phpmyadmin%"),"phpmyadmin", like(uri_path,"%solr/admin%"),"solr_admin", like(uri_path,"%manager/html%"),"tomcat_manager", like(uri_path,"%../..%"),"path_traversal", like(uri_path,"%shell.php%") OR like(uri_path,"%eval-stdin%"),"webshell_probe", like(http_user_agent,"%sqlmap%") OR like(http_user_agent,"%Nikto%") OR like(http_user_agent,"%Nessus%") OR like(http_user_agent,"%Acunetix%") OR like(http_user_agent,"%masscan%") OR like(http_user_agent,"%zgrab%") OR like(http_user_agent,"%Nuclei%") OR like(http_user_agent,"%dirbuster%") OR like(http_user_agent,"%gobuster%") OR like(http_user_agent,"%wpscan%") OR like(http_user_agent,"%OpenVAS%") OR like(http_user_agent,"%Qualys%"),"scanner_useragent", true(),"other_scanner_signature")
| eval Subnet24=replace(src_ip,"^(\d+\.\d+\.\d+)\.\d+$","\1.0/24")
| stats dc(MatchedSignature) AS DistinctSignatures, dc(uri_path) AS DistinctPaths, dc(src_ip) AS DistinctSourceIPs, count AS TotalRequests, min(_time) AS FirstSeen, max(_time) AS LastSeen, values(MatchedSignature) AS Signatures BY Subnet24, src_ip
| eval BurstDurationMinutes=round((LastSeen-FirstSeen)/60,1)
| eval DetectionType=if(DistinctSourceIPs<=1,"ConcentratedBurst","LowAndSlowSubnetRotation")
| eval RiskScore=case(DistinctSignatures>=15,95, DistinctSignatures>=10,86, DistinctSignatures>=6,76, true(),50)
| where DistinctSignatures>=6 AND (DistinctPaths>=10 OR DistinctSourceIPs>=3)
| sort - RiskScore

SPL equivalent of the KQL detection. Matches scanner-signature paths and known scanner User-Agent strings, categorises the matched signature per request, computes a /24 subnet grouping via regex replace on src_ip, then aggregates distinct signature/path/source-IP counts to distinguish a single-IP ConcentratedBurst from a multi-IP LowAndSlowSubnetRotation within the same subnet.

high severity medium confidence

Data Sources

WAF logs (F5 BIG-IP ASM, Fortinet FortiWeb) Perimeter firewall logs (Cisco ASA) Reverse proxy access logs

Required Sourcetypes

f5:bigip:asm fortinet:fortiweb cisco:asa waf nginx:plus:kv

False Positives

Authorized internal or contracted vulnerability management scans (Qualys, Nessus, Tenable, Rapid7) running against production on an approved scanning schedule
Bug bounty researchers or penetration testers operating within an approved rules-of-engagement window
Uptime/synthetic monitoring services (Pingdom, UptimeRobot, StatusCake) or health-check bots hitting many paths from a small set of monitoring IPs
SEO crawlers, CDN health probes, or archival bots (Googlebot, Bingbot, Wayback Machine) traversing many URL paths that incidentally overlap scanner signature patterns
Load testing tools or CI/CD smoke tests hitting numerous endpoints rapidly from a shared build-agent IP address

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceIP,
  "URL" AS RequestPath,
  "User Agent" AS UserAgent,
  UNIQUECOUNT("URL") AS DistinctPaths,
  CASE
    WHEN "URL" ILIKE '%.env%' THEN '.env'
    WHEN "URL" ILIKE '%.git%' THEN '.git'
    WHEN "URL" ILIKE '%wp-login%' OR "URL" ILIKE '%wp-admin%' THEN 'wordpress_admin'
    WHEN "URL" ILIKE '%xmlrpc.php%' THEN 'xmlrpc'
    WHEN "URL" ILIKE '%actuator%' THEN 'spring_actuator'
    WHEN "URL" ILIKE '%phpmyadmin%' THEN 'phpmyadmin'
    WHEN "URL" ILIKE '%solr/admin%' THEN 'solr_admin'
    WHEN "URL" ILIKE '%manager/html%' THEN 'tomcat_manager'
    WHEN "URL" ILIKE '%../../%' THEN 'path_traversal'
    WHEN "URL" ILIKE '%shell.php%' OR "URL" ILIKE '%eval-stdin%' THEN 'webshell_probe'
    WHEN "User Agent" ILIKE '%sqlmap%' OR "User Agent" ILIKE '%Nikto%' OR "User Agent" ILIKE '%Nessus%' OR "User Agent" ILIKE '%Acunetix%' OR "User Agent" ILIKE '%masscan%' OR "User Agent" ILIKE '%zgrab%' OR "User Agent" ILIKE '%Nuclei%' OR "User Agent" ILIKE '%wpscan%' THEN 'scanner_useragent'
    ELSE 'other_scanner_signature'
  END AS MatchedSignature
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (66, 4, 250)
  AND starttime > NOW() - 86400000
  AND (
    "URL" ILIKE '%.env%' OR "URL" ILIKE '%.git%' OR "URL" ILIKE '%wp-login%' OR "URL" ILIKE '%wp-admin%'
    OR "URL" ILIKE '%xmlrpc.php%' OR "URL" ILIKE '%actuator%' OR "URL" ILIKE '%phpmyadmin%'
    OR "URL" ILIKE '%solr/admin%' OR "URL" ILIKE '%manager/html%' OR "URL" ILIKE '%../../%'
    OR "URL" ILIKE '%shell.php%' OR "URL" ILIKE '%eval-stdin%'
    OR "User Agent" ILIKE '%sqlmap%' OR "User Agent" ILIKE '%Nikto%' OR "User Agent" ILIKE '%Nessus%'
    OR "User Agent" ILIKE '%Acunetix%' OR "User Agent" ILIKE '%masscan%' OR "User Agent" ILIKE '%zgrab%'
    OR "User Agent" ILIKE '%Nuclei%' OR "User Agent" ILIKE '%wpscan%'
  )
GROUP BY SourceIP
HAVING UNIQUECOUNT("URL") >= 8
ORDER BY DistinctPaths DESC

AQL query for IBM QRadar aggregating scanner-signature path matches per source IP over a 24-hour window, flagging source IPs that touch >=8 distinct URL paths matching known scanner signatures.

high severity medium confidence

Data Sources

IBM QRadar SIEM WAF/reverse-proxy log sources (DSMs for F5, Fortinet, Imperva)

Required Tables

events

False Positives

Authorized internal or contracted vulnerability management scans (Qualys, Nessus, Tenable, Rapid7) running against production on an approved scanning schedule
Bug bounty researchers or penetration testers operating within an approved rules-of-engagement window
Uptime/synthetic monitoring services (Pingdom, UptimeRobot, StatusCake) or health-check bots hitting many paths from a small set of monitoring IPs
SEO crawlers, CDN health probes, or archival bots (Googlebot, Bingbot, Wayback Machine) traversing many URL paths that incidentally overlap scanner signature patterns
Load testing tools or CI/CD smoke tests hitting numerous endpoints rapidly from a shared build-agent IP address

Sumo Logic CSE

sql

_sourceCategory=*waf* OR _sourceCategory=*firewall* OR _sourceCategory=*reverseproxy*
| parse "uri_path=\"*\"" as UriPath nodrop
| parse "src_ip=*," as SourceIP nodrop
| parse "http_user_agent=\"*\"" as UserAgent nodrop
| where (UriPath matches "*.env*" or UriPath matches "*.git*" or UriPath matches "*wp-login*"
    or UriPath matches "*wp-admin*" or UriPath matches "*xmlrpc.php*" or UriPath matches "*actuator*"
    or UriPath matches "*phpmyadmin*" or UriPath matches "*solr/admin*" or UriPath matches "*manager/html*"
    or UriPath matches "*../../*" or UriPath matches "*shell.php*" or UriPath matches "*eval-stdin*"
    or UserAgent matches "*sqlmap*" or UserAgent matches "*Nikto*" or UserAgent matches "*Nessus*"
    or UserAgent matches "*Acunetix*" or UserAgent matches "*masscan*" or UserAgent matches "*zgrab*"
    or UserAgent matches "*Nuclei*" or UserAgent matches "*wpscan*")
| if (UriPath matches "*.env*", ".env",
    if (UriPath matches "*.git*", ".git",
      if (UriPath matches "*wp-login*" or UriPath matches "*wp-admin*", "wordpress_admin",
        if (UriPath matches "*xmlrpc.php*", "xmlrpc",
          if (UriPath matches "*actuator*", "spring_actuator", "other_scanner_signature"))))) as MatchedSignature
| count as Requests, count_distinct(UriPath) as DistinctPaths, count_distinct(MatchedSignature) as DistinctSignatures by SourceIP
| where DistinctSignatures >= 6 and DistinctPaths >= 10
| sort by DistinctSignatures

Sumo Logic query parsing WAF/reverse-proxy log fields, categorising matched scanner signatures, and aggregating distinct signature/path counts per source IP to flag a concentrated burst.

high severity medium confidence

Data Sources

Sumo Logic Cloud SIEM WAF/reverse-proxy log sources via Sumo Logic Collector

Required Tables

_sourceCategory=*waf* _sourceCategory=*firewall*

False Positives

Authorized internal or contracted vulnerability management scans (Qualys, Nessus, Tenable, Rapid7) running against production on an approved scanning schedule
Bug bounty researchers or penetration testers operating within an approved rules-of-engagement window
Uptime/synthetic monitoring services (Pingdom, UptimeRobot, StatusCake) or health-check bots hitting many paths from a small set of monitoring IPs
SEO crawlers, CDN health probes, or archival bots (Googlebot, Bingbot, Wayback Machine) traversing many URL paths that incidentally overlap scanner signature patterns
Load testing tools or CI/CD smoke tests hitting numerous endpoints rapidly from a shared build-agent IP address

Google Chronicle / SecOps

yaral

rule distributed_vuln_scan_burst {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects concentrated or low-and-slow vulnerability scanner signature bursts against externally-facing web infrastructure"
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Reconnaissance"
    mitre_attack_technique = "T1595.002"
    reference = "https://attack.mitre.org/techniques/T1595/002/"

  events:
    $e1.metadata.event_type = "NETWORK_HTTP"
    and (
      re.regex($e1.target.url, `(?i)(\.env|\.git|wp-login|wp-admin|xmlrpc\.php|actuator|phpmyadmin|solr/admin|manager/html|shell\.php|eval-stdin)`)
      or re.regex($e1.target.url, `(?i)(\.\./\.\.|%2e%2e)`)
      or re.regex($e1.network.http.user_agent, `(?i)(sqlmap|nikto|nessus|acunetix|masscan|zgrab|nuclei|dirbuster|gobuster|wpscan|openvas|qualys)`)
    )

  match:
    $e1.principal.ip over 1h

  condition:
    $e1 and #e1 >= 6
}

Chronicle YARA-L 2.0 rule matching scanner-signature URL paths and User-Agent strings on NETWORK_HTTP events, requiring at least 6 matching events from the same principal IP within a 1-hour match window.

high severity medium confidence

Data Sources

Google Chronicle SIEM WAF/reverse-proxy logs via Chronicle forwarder

Required Tables

NETWORK_HTTP

False Positives

Authorized internal or contracted vulnerability management scans (Qualys, Nessus, Tenable, Rapid7) running against production on an approved scanning schedule
Bug bounty researchers or penetration testers operating within an approved rules-of-engagement window
Uptime/synthetic monitoring services (Pingdom, UptimeRobot, StatusCake) or health-check bots hitting many paths from a small set of monitoring IPs
SEO crawlers, CDN health probes, or archival bots (Googlebot, Bingbot, Wayback Machine) traversing many URL paths that incidentally overlap scanner signature patterns
Load testing tools or CI/CD smoke tests hitting numerous endpoints rapidly from a shared build-agent IP address

CrowdStrike LogScale (CQL)

cql

// Distributed Vulnerability Scan Burst Detection - CrowdStrike NG-SIEM (LogScale), WAF/CDN log ingest
#event_simpleName=HttpRequest OR #event_simpleName=WafAccessLog
| in(field=uri_path, values=["*.env*","*.git*","*wp-login*","*wp-admin*","*xmlrpc.php*","*actuator*","*phpmyadmin*","*solr/admin*","*manager/html*","*../../*","*shell.php*","*eval-stdin*"], ignoreCase=true)
  OR in(field=http_user_agent, values=["*sqlmap*","*Nikto*","*Nessus*","*Acunetix*","*masscan*","*zgrab*","*Nuclei*","*dirbuster*","*gobuster*","*wpscan*","*OpenVAS*","*Qualys*"], ignoreCase=true)
| MatchedSignature := case {
    uri_path = /\.env/i -> ".env";
    uri_path = /\.git/i -> ".git";
    uri_path = /(wp-login|wp-admin)/i -> "wordpress_admin";
    uri_path = /xmlrpc\.php/i -> "xmlrpc";
    uri_path = /actuator/i -> "spring_actuator";
    uri_path = /phpmyadmin/i -> "phpmyadmin";
    uri_path = /manager\/html/i -> "tomcat_manager";
    * -> "other_scanner_signature";
  }
| groupBy([src_ip], function=([count(as=TotalRequests), distinct(uri_path, as=DistinctPaths), distinct(MatchedSignature, as=DistinctSignatures)]))
| test(DistinctSignatures >= 6 and DistinctPaths >= 10)
| sort(DistinctSignatures, order=desc)

CrowdStrike NG-SIEM (LogScale) query over ingested WAF/CDN HTTP access logs, categorising matched scanner signatures and grouping by source IP to flag source IPs touching >=6 distinct signature categories across >=10 distinct paths.

high severity medium confidence

Data Sources

CrowdStrike NG-SIEM (LogScale) third-party WAF/CDN log ingestion

Required Tables

HttpRequest WafAccessLog

False Positives

Authorized internal or contracted vulnerability management scans (Qualys, Nessus, Tenable, Rapid7) running against production on an approved scanning schedule
Bug bounty researchers or penetration testers operating within an approved rules-of-engagement window
Uptime/synthetic monitoring services (Pingdom, UptimeRobot, StatusCake) or health-check bots hitting many paths from a small set of monitoring IPs
SEO crawlers, CDN health probes, or archival bots (Googlebot, Bingbot, Wayback Machine) traversing many URL paths that incidentally overlap scanner signature patterns
Load testing tools or CI/CD smoke tests hitting numerous endpoints rapidly from a shared build-agent IP address

Sigma rule & cross-platform mapping

The detection logic for Distributed Vulnerability Scanning Burst Against Web Infrastructure (THREAT-Recon-DistributedVulnScanBurst) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: network_connection
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for THREAT-Recon-DistributedVulnScanBurst Sigma rules on detection.fyi

Platform-specific guides for THREAT-Recon-DistributedVulnScanBurst

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-07-20 Research depth: deep

References (5)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Scanner Signature Path Sweep (Concentrated Burst)
Expected signal: WAF/reverse-proxy logs show >=10 distinct scanner-signature paths requested within seconds from the tester's single source IP, User-Agent 'AtomicTest-VulnScan/1.0'.
Test 2Known Scanner Tool User-Agent Sweep
Expected signal: WAF logs show dozens of distinct paths (config, admin, CGI, backup file probes) and User-Agent containing 'Nikto' from the tester's source IP within minutes.
Test 3Low-and-Slow Subnet-Rotated Scan Simulation
Expected signal: WAF logs show 4 distinct source IPs within 198.51.100.0/24, each issuing 2 scanner-signature requests spread across several hours, collectively covering >=8 distinct signature categories.

Response Playbook

Triage

Confirm whether the source IP(s)/subnet correspond to a known, authorized scanner (internal vulnerability-management platform, contracted pentest firm, bug bounty program) by checking IP allowlists and scanning calendars before treating this as hostile.
Review the specific signature categories matched (config-file probes, admin-panel paths, framework actuator endpoints, path traversal, webshell probes) to assess whether the actor is doing broad fingerprinting or targeting a vulnerability class relevant to your actual stack.
Check WAF/reverse-proxy response codes for the matched requests: a 200 or 500 response on a scanner-signature path indicates the probed resource may genuinely exist and warrants an immediate deep-dive, versus uniform 403/404 broad blind probing.
For the low-and-slow variant, pivot on the /24 subnet or ASN of the rotating source IPs to determine whether they belong to a cloud-hosting provider commonly used for scanning infrastructure, or to a residential/proxy range indicating botnet-driven scanning.
Cross-reference the scanned paths against your actual technology stack (CMS, frameworks, app servers in use) — probes for irrelevant technology (e.g. WordPress paths against a pure API service) indicate blind broad-spectrum internet scanning rather than targeted recon of your environment specifically.

Containment

Rate-limit or block the offending source IP(s) / subnet at the WAF/CDN edge (Cloudflare, Azure Front Door, F5) once authorization has been ruled out.
If low-and-slow subnet rotation is confirmed against a hosting-provider ASN, apply an ASN-level or geo-based rate limit rather than single-IP blocks, since the actor will continue rotating source addresses within the range.
Immediately lock down or remove any endpoint confirmed to exist via a 200/500 response on a sensitive config/debug/admin/webshell-probe path — the recon itself already revealed the exposure.
Notify the vulnerability-management or pentest-coordination owner to confirm or rule out an authorized scanning window before escalating further.

Evidence Collection

Full WAF/reverse-proxy access logs for the source IP(s)/subnet spanning the detection window, including request path, query string, headers, User-Agent, and response code/size for every request.
Whois/ASN lookup and threat-intelligence enrichment (GreyNoise, AbuseIPDB, Shodan) on the source IP(s) to classify known-scanner infrastructure versus a likely-compromised host.
A chronological timeline of distinct signature categories observed, to reconstruct the scanner's fingerprinting sequence and identify what technology it believes it found.
Any downstream alerts (WAF blocks, IDS/IPS hits, application error logs) correlated to the same source IP/subnet and time window.

Escalation Criteria

! Any scanner-signature request returns HTTP 200 or 500 against a config/debug/admin/webshell-probe path, indicating the probed resource may actually exist.
! The same source IP or subnet pivots from broad vulnerability scanning to authentication attempts (login POST requests) or exploitation payloads (SQLi/RCE strings) within the same session, indicating recon has transitioned to active exploitation.
! Distinct-signature count exceeds 20 in a single burst window, or the low-and-slow pattern persists across multiple consecutive 24-hour windows, indicating a dedicated persistent actor rather than opportunistic internet-wide noise.
! The scanning activity is not attributable to any authorized internal or contracted scanning program after checking allowlists and calendars.

Investigation Guide

Forensic Artifacts

> WAF/reverse-proxy access logs: request path, query string, headers, User-Agent, and response code/size per request
> CDN edge logs (Cloudflare, Azure Front Door, Akamai) distinguishing edge cache-hit from origin-forwarded requests from the scanning source
> Threat-intel enrichment records (GreyNoise, Shodan, AbuseIPDB) classifying the source IP/ASN at the time of the scan
> Downstream IDS/IPS or application error logs correlated to the same source and time window

Tuning Guidance

Maintain an allowlist of known-authorized vulnerability scanner and monitoring IP ranges (internal Qualys/Nessus/Tenable appliances, contracted pentest firm ranges, uptime-monitoring services) and exclude them at the top of both queries — legitimate scheduled scans will otherwise trip both ConcentratedBurst and LowAndSlowSubnetRotation on every scan cycle. Tune the DistinctSignatures/DistinctPaths thresholds (currently 6/10 for the burst, 8 signatures across 3-25 distinct source IPs for low-and-slow) upward for high-traffic public sites with heavy legitimate crawler/bot diversity, and downward for low-traffic internal-facing apps where any signature diversity is anomalous. Prioritise alerts where a scanner-signature request returned 200/500 over uniform 403/404, since those indicate the probed resource genuinely exists.

Hunting Queries

Once a source IP is confirmed malicious, pivot across the full environment (all sites/tenants behind the WAF) over the prior 7 days to identify every other host it touched — distributed scanners frequently probe multiple properties from the same infrastructure before or after the detected burst.

Hunting — KQL

kql

CommonSecurityLog
| where TimeGenerated > ago(7d)
| where SourceIP == "REPLACE_WITH_CONFIRMED_SCANNER_IP"
| summarize RequestCount = count(), DistinctTargets = dcount(DestinationHostName), Targets = make_set(DestinationHostName), Paths = make_set(RequestURL) by SourceIP, bin(TimeGenerated, 1h)
| sort by TimeGenerated asc

Hunting — SPL

spl

index=waf OR index=firewall src_ip="REPLACE_WITH_CONFIRMED_SCANNER_IP" earliest=-7d
| stats count AS RequestCount, dc(dest_host) AS DistinctTargets, values(dest_host) AS Targets, values(uri_path) AS Paths BY src_ip, span=1h
| sort _time

Atomic Red Team Tests

Test 1 Scanner Signature Path Sweep (Concentrated Burst)

linux

Rapidly requests a set of known vulnerability-scanner-signature paths (config files, admin panels, framework actuator endpoints, CGI probes) against a target from a single source IP within seconds, simulating the ConcentratedBurst detection pattern.

Command

bash

for p in /.env /.git/config /wp-login.php /xmlrpc.php /actuator/env /phpmyadmin/ /solr/admin/ /manager/html /cgi-bin/test.cgi /server-status; do curl -s -o /dev/null -A "AtomicTest-VulnScan/1.0" "https://TARGET_HOST$p"; done

Cleanup

bash

unset p

Expected Telemetry

WAF/reverse-proxy logs show >=10 distinct scanner-signature paths requested within seconds from the tester's single source IP, User-Agent 'AtomicTest-VulnScan/1.0'.

Expected Detection

Fires ConcentratedBurst with DistinctSignatures >= 6, DistinctPaths >= 10, RiskScore >= 78.

Test 2 Known Scanner Tool User-Agent Sweep

linux

Runs Nikto against the target, generating a wide diversity of scanner-signature path probes and a fingerprinted scanner User-Agent string in a single short-lived session.

Command

bash

nikto -h https://TARGET_HOST -o /tmp/nikto_out.txt -Tuning 123456789

Cleanup

bash

rm -f /tmp/nikto_out.txt

Expected Telemetry

WAF logs show dozens of distinct paths (config, admin, CGI, backup file probes) and User-Agent containing 'Nikto' from the tester's source IP within minutes.

Expected Detection

Fires ConcentratedBurst with DistinctSignatures well above the 6-category threshold; RiskScore >= 88 given high signature diversity.

Test 3 Low-and-Slow Subnet-Rotated Scan Simulation

linux

Simulates distributed low-and-slow scanning by issuing scanner-signature requests from multiple source addresses within the same /24 test range (e.g. via a local proxy/interface pool), spreading the same signature diversity across several hours to stay under a per-IP burst threshold.

Command

bash

for ip in 198.51.100.10 198.51.100.11 198.51.100.12 198.51.100.13; do curl -s -o /dev/null --interface $ip -A "AtomicTest-VulnScan/1.0" "https://TARGET_HOST/.env"; curl -s -o /dev/null --interface $ip -A "AtomicTest-VulnScan/1.0" "https://TARGET_HOST/actuator/env"; sleep 3600; done

Cleanup

bash

unset ip

Expected Telemetry

WAF logs show 4 distinct source IPs within 198.51.100.0/24, each issuing 2 scanner-signature requests spread across several hours, collectively covering >=8 distinct signature categories.

Expected Detection

Fires LowAndSlowSubnetRotation once the 24h window accumulates DistinctSourceIPs between 3-25 and DistinctSignatures >= 8; RiskScore >= 72.

Related Detections

Tactic Hub

TA0043Reconnaissance

Detection Variants (2)

Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.

Parent Technique

T1595.002Vulnerability Scanning

Related Techniques

T1595.001Scanning IP Blocks T1590Gather Victim Network Information T1592Gather Victim Host Information T1190Exploit Public-Facing Application T1189Drive-by Compromise

What is THREAT-Recon-DistributedVulnScanBurst Distributed Vulnerability Scanning Burst Against Web Infrastructure?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for THREAT-Recon-DistributedVulnScanBurst

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hub

Detection Variants (2)

Parent Technique

Related Techniques

Same Tactic: Reconnaissance

Popular Detections

Get new detections in your inbox